102 lines
5.0 KiB
XML
102 lines
5.0 KiB
XML
<?xml version="1.0" encoding="utf-8"?>
|
|
<ioc xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" id="5a71edc8-26a8-43fb-8271-5c948e96ca05" last-modified="2018-01-31T00:00:00" xmlns="http://schemas.mandiant.com/2010/ioc">
|
|
<short_description>Event #133</short_description>
|
|
<description>Familiar Feeling: A Malware Campaign Targeting the Tibetan Diaspora Resurfaces</description>
|
|
<keywords />
|
|
<authored_by>citizenlab</authored_by>
|
|
<authored_date>2018-01-31T00:00:00</authored_date>
|
|
<links />
|
|
<definition>
|
|
<Indicator operator="OR" id="5a71edc8-26a8-43fb-8271-5c948e96ca05">
|
|
<IndicatorItem id="commail.co" condition="is">
|
|
<Context document="Network" search="Network/DNS" type="mir" />
|
|
<Content type="string"></Content>
|
|
</IndicatorItem>
|
|
<IndicatorItem id="tibetfrum.info" condition="is">
|
|
<Context document="Network" search="Network/DNS" type="mir" />
|
|
<Content type="string"></Content>
|
|
</IndicatorItem>
|
|
<IndicatorItem id="tibethouse.info" condition="is">
|
|
<Context document="Network" search="Network/DNS" type="mir" />
|
|
<Content type="string"></Content>
|
|
</IndicatorItem>
|
|
<IndicatorItem id="tibetnews.info" condition="is">
|
|
<Context document="Network" search="Network/DNS" type="mir" />
|
|
<Content type="string"></Content>
|
|
</IndicatorItem>
|
|
<IndicatorItem id="daynew.today" condition="is">
|
|
<Context document="Network" search="Network/DNS" type="mir" />
|
|
<Content type="string"></Content>
|
|
</IndicatorItem>
|
|
<IndicatorItem id="daynews.today" condition="is">
|
|
<Context document="Network" search="Network/DNS" type="mir" />
|
|
<Content type="string"></Content>
|
|
</IndicatorItem>
|
|
<IndicatorItem id="tibetnews.today" condition="is">
|
|
<Context document="Network" search="Network/DNS" type="mir" />
|
|
<Content type="string"></Content>
|
|
</IndicatorItem>
|
|
<IndicatorItem id="comemails.email" condition="is">
|
|
<Context document="Network" search="Network/DNS" type="mir" />
|
|
<Content type="string"></Content>
|
|
</IndicatorItem>
|
|
<IndicatorItem id="comemail.email" condition="is">
|
|
<Context document="Network" search="Network/DNS" type="mir" />
|
|
<Content type="string"></Content>
|
|
</IndicatorItem>
|
|
<IndicatorItem id="google.comemail.email" condition="is">
|
|
<Context document="Network" search="Network/DNS" type="mir" />
|
|
<Content type="string"></Content>
|
|
</IndicatorItem>
|
|
<IndicatorItem id="google.comemails.email" condition="is">
|
|
<Context document="Network" search="Network/DNS" type="mir" />
|
|
<Content type="string"></Content>
|
|
</IndicatorItem>
|
|
<IndicatorItem id="google.commail.co" condition="is">
|
|
<Context document="Network" search="Network/DNS" type="mir" />
|
|
<Content type="string"></Content>
|
|
</IndicatorItem>
|
|
<IndicatorItem id="google.commail.email" condition="is">
|
|
<Context document="Network" search="Network/DNS" type="mir" />
|
|
<Content type="string"></Content>
|
|
</IndicatorItem>
|
|
<IndicatorItem id="mail.google.commail.co" condition="is">
|
|
<Context document="Network" search="Network/DNS" type="mir" />
|
|
<Content type="string"></Content>
|
|
</IndicatorItem>
|
|
<IndicatorItem id="www.comemail.email" condition="is">
|
|
<Context document="Network" search="Network/DNS" type="mir" />
|
|
<Content type="string"></Content>
|
|
</IndicatorItem>
|
|
<IndicatorItem id="www.google.comemails.email" condition="is">
|
|
<Context document="Network" search="Network/DNS" type="mir" />
|
|
<Content type="string"></Content>
|
|
</IndicatorItem>
|
|
<IndicatorItem id="27.126.186.222" condition="is">
|
|
<Context document="RouteEntryItem" search="RouteEntryItem/Destination" type="mir" />
|
|
<Content type="IP"></Content>
|
|
</IndicatorItem>
|
|
<IndicatorItem id="103.55.24.196" condition="is">
|
|
<Context document="RouteEntryItem" search="RouteEntryItem/Destination" type="mir" />
|
|
<Content type="IP"></Content>
|
|
</IndicatorItem>
|
|
<IndicatorItem id="203.189.232.207" condition="is">
|
|
<Context document="RouteEntryItem" search="RouteEntryItem/Destination" type="mir" />
|
|
<Content type="IP"></Content>
|
|
</IndicatorItem>
|
|
<IndicatorItem id="45.127.97.222" condition="is">
|
|
<Context document="RouteEntryItem" search="RouteEntryItem/Destination" type="mir" />
|
|
<Content type="IP"></Content>
|
|
</IndicatorItem>
|
|
<IndicatorItem id="115.126.86.151" condition="is">
|
|
<Context document="RouteEntryItem" search="RouteEntryItem/Destination" type="mir" />
|
|
<Content type="IP"></Content>
|
|
</IndicatorItem>
|
|
<IndicatorItem id="27.126.176.169" condition="is">
|
|
<Context document="RouteEntryItem" search="RouteEntryItem/Destination" type="mir" />
|
|
<Content type="IP"></Content>
|
|
</IndicatorItem>
|
|
</Indicator>
|
|
</definition>
|
|
</ioc>
|